Fluxus[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
Fluxus.exe
Size 3.0MB
Sample260920-ycppra1vcy
SHA256 06c734d9bd36ecc60a7263c04454164f3160fa64cfd8c140dd8f69bd1ddb34a8
MD5 21aa6a34ad905761dc17cb11252e3047
SHA1 3c31e90cf923deb37648baccd94e2829c0582e66
SHA512 2df123f1d27b98e192e21feb7a025275c092a33c37263d54675f322e9c8d49df2b7ffd2427ac3e4ad1b1634ef4bbcea029c461203daf73faac72f13d9aac2de1
SSDEEP 49152:6uDdgW9a0cyKWfZL7vDsZssO+QhuhF8Pikv2WNTUCPvGzOsBCpz63ck0HrSWB:PZgjyKWBnvYQI8Pikv5TrPvnsBM6sr
TLSH
T175E52265E7D824F9E1739678DA739502DA72BC1B0B70C9CF07A459060E37AD0993AF32
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Fluxus.exe

File Explorer

Fluxus.exe

.exe 3.0MB

Fluxus.exe

IMPHASH 3fbc9c6dd19d8631ab1b9552b90e3a6a
SHA256 06c734d9bd36ecc60a7263c04454164f3160fa64cfd8c140dd8f69bd1ddb34a8
MD5 21aa6a34ad905761dc17cb11252e3047
SHA1 3c31e90cf923deb37648baccd94e2829c0582e66
SHA512 2df123f1d27b98e192e21feb7a025275c092a33c37263d54675f322e9c8d49df2b7ffd2427ac3e4ad1b1634ef4bbcea029c461203daf73faac72f13d9aac2de1
SSDEEP 49152:6uDdgW9a0cyKWfZL7vDsZssO+QhuhF8Pikv2WNTUCPvGzOsBCpz63ck0HrSWB:PZgjyKWBnvYQI8Pikv5TrPvnsBM6sr
TLSH
T175E52265E7D824F9E1739678DA739502DA72BC1B0B70C9CF07A459060E37AD0993AF32
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

144944

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

winhttp

WinHttpCrackUrl WinHttpReceiveResponse WinHttpSendRequest WinHttpOpenRequest WinHttpSetOption WinHttpQueryDataAvailable WinHttpReadData WinHttpConnect WinHttpCloseHandle WinHttpOpen WinHttpQueryHeaders

bcrypt

BCryptGenerateSymmetricKey BCryptCloseAlgorithmProvider BCryptSetProperty BCryptGetProperty BCryptDestroyHash BCryptEncrypt BCryptImportKeyPair BCryptDestroyKey BCryptCreateHash BCryptHashData BCryptGenRandom BCryptFinishHash BCryptOpenAlgorithmProvider

user32

ReleaseDC GetSystemMetrics MessageBoxW GetDC

advapi32

OpenProcessToken GetUserNameA RegCloseKey RegCreateKeyExW RegDeleteKeyW RegOpenKeyExW RegQueryValueExW RegSetValueExW CloseServiceHandle ConvertStringSecurityDescriptorToSecurityDescriptorW OpenServiceW OpenSCManagerW ControlService GetTokenInformation

shell32

ShellExecuteExW SHGetFolderPathW

ntdll

NtClose NtWaitForSingleObject NtQueryInformationProcess RtlGetVersion RtlPcToFileHeader RtlLookupFunctionEntry RtlUnwindEx RtlCaptureContext RtlVirtualUnwind

gdi32

CreateCompatibleDC BitBlt DeleteObject GetDIBits SelectObject DeleteDC CreateCompatibleBitmap

kernel32

GetModuleHandleExW FreeLibrary DeleteCriticalSection InitializeCriticalSectionEx LeaveCriticalSection LCMapStringW SetStdHandle GetStringTypeW HeapSize HeapReAlloc SetEndOfFile WriteConsoleW GetStdHandle IsProcessorFeaturePresent EnterCriticalSection EncodePointer FlsFree LoadLibraryExW InitializeCriticalSectionAndSpinCount FreeEnvironmentStringsW IsDebuggerPresent UnhandledExceptionFilter GetFileType FlushFileBuffers GetConsoleOutputCP GetConsoleMode ReadConsoleW ExitProcess GetEnvironmentStringsW GetCommandLineA FlsSetValue FlsGetValue GetCommandLineW GetEnvironmentVariableW CreateDirectoryW CreateFileW DeleteFileW FindClose FindFirstFileW FindNextFileW GetFileAttributesW GetFileSizeEx ReadFile RemoveDirectoryW SetFileAttributesW SetFileInformationByHandle WriteFile GetTempPathW CloseHandle SetHandleInformation SetUnhandledExceptionFilter GetLastError CreatePipe ConnectNamedPipe PeekNamedPipe CreateNamedPipeW HeapAlloc HeapFree GetProcessHeap GetOverlappedResult CancelIo ResetEvent WaitForSingleObject CreateEventW Sleep GetCurrentProcess GetCurrentProcessId FlsAlloc TerminateProcess GetExitCodeProcess CreateThread TerminateThread GetExitCodeThread CreateProcessW InitializeProcThreadAttributeList DeleteProcThreadAttributeList UpdateProcThreadAttribute GetProcessMitigationPolicy OpenProcess GetLocalTime GetTickCount GetTickCount64 GetSystemDirectoryW IsWow64Process GetModuleFileNameW GetModuleHandleW GetProcAddress LoadResource LockResource SizeofResource FindResourceW LoadLibraryW LocalFree CopyFileW GetComputerNameA MultiByteToWideChar WideCharToMultiByte CreateToolhelp32Snapshot Process32FirstW Process32NextW ReleaseSRWLockExclusive AcquireSRWLockExclusive WakeAllConditionVariable SleepConditionVariableSRW GetStartupInfoW QueryPerformanceCounter GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead SetLastError GetCPInfo GetOEMCP GetACP IsValidCodePage FindFirstFileExW RaiseException SetFilePointerEx